claim based identities are transformed to a set of credentials and securely stored in a secure data store using a number of encryption schemes. The credentials are then used to authenticate applications requiring specific credential types. For each call to the secure store system, a client application may provide a claims token issued by a trusted source, which is used to search for corresponding credentials in the secure data store if the credentials have been created previously for the user.
|
1. A method to be executed at least in part in a computing device including a memory storing instructions and a processor executing an application in conjunction with the stored instructions for transforming a claim based identity to a credential based identity, the method comprising:
receiving at a secure store service residing on an application server a claim based identity via a security token issued by a trusted authority to a client entity at a front end server through a secure store service proxy residing at the front end server;
mapping a credential to the claim based identity;
validating the claim at the secure store service on the application server;
storing the credential in a secure manner in a secure store database (SSD) associated with the secure store service;
encrypting on the application server the credential stored in the secure store database associated with the secure store service utilizing a master key generated and managed by a key manager;
synchronizing the master key to a new service instance at the key manager;
in response to receiving the security token for each request to access a resource associated with the secure store service, retrieving the credential from a secure store database;
employing a credential manager for decrypting the retrieved credential on the application server;
returning the decrypted credential to the client entity of the request for use in authorization of the client entity to an access controlled resource;
backing up and restoring the SSD at the key manager; and
enabling a user and an administrator to at least one from a set of: create, read, and delete an application employing an application management API declared by an application manager.
2. The method of
3. The method of
4. The method of
employing secure Socket Layer (SSL) protocol to secure the credential between the secure store service and the security token service.
5. The method of
6. The method of
7. The method of
8. The method of
synchronizing the master key to each new secure store service instance at the key manager; and
synchronizing the master key to a change in a secure store service account associated with the user.
9. The method of
10. A computer-readable memory device with instructions stored thereon for transforming a claim based identity to a credential based identity, the instructions comprising:
receiving a claim at a secure Token service (STS);
providing a security token upon authenticating the claim;
receiving at a secure store service (SSS) residing on an application server a claim based identity via the security token issued by a trusted authority to a client entity at a front end server through a SSS proxy residing at the front end server, wherein the a trust relationship between the SSS and the STS has been established;
authenticating the claim based identity;
requesting a credential from a credential manager through the SSS proxy;
retrieving the requested credential form the credential manager;
upon receiving the credential request, validating the claim;
mapping the credential to the claim based on the security token;
encrypting the credential stored in the secure store database associated with the SSS using a master key generated and managed by a key manager and stored in a registry associated with the application server;
synchronizing the master key to a new service instance at the key manager;
modifying a master secret key at the key manager and storing the master secret key at the registry associated with the application server, wherein the master secret key includes the master key and the credential encrypted with a trusted source provided pass phrase;
storing the encrypted credential in a secure manner in a secure store database (SSD) associated with the SSS for use in authorization of subsequent requests for access by a user associated with the claim through providing the credential mapped to the claim;
decrypting the encrypted credential at the credential manager;
receiving the decrypted credential form the credential manager at the SSS;
providing the decrypted credential from the SSS to the client entity through the SSS proxy;
backing up and restoring the SSD by the key manager; and
enabling one of the user and an administrator to at least one from a set of: create, read, and delete an application employing an application management API declared by an application manager.
11. The computer-readable memory device of
12. The computer-readable memory device of
13. The computer-readable memory device of
14. A system for transforming a claim based identity to a credential based identity, the system comprising:
a web server including a memory and a processor coupled to the memory, the processor configured to execute:
a security Token service (STS) executed on a web server for receiving a request for a security token from a client application and providing the security token to the client application upon authentication of a user associated with the claim, wherein the security token is a security Assertions Markup Language (SAML) token;
a first secure store service (SSS) proxy for handling requests from rich clients and web browser clients;
a second SSS proxy for handling requests from web browser clients only;
an application server including a memory and a processor coupled to the memory, the processor configured to execute a secure store service (SSS) that includes:
an SSS application for:
validating the claim;
authenticating the claim based identity;
mapping credentials to the claim based on a received security token, wherein the credentials are created based on a Single Sign-On (SSO) claim based identity without relying on dependencies of underlying SSO architecture;
in response to receiving a request for access to a resource, searching for stored credentials in a secure store database associated with the SSS corresponding to the security token associated with a user submitting the request and providing the stored credentials to the user through one of the first SSS proxy and second SSS proxy;
a credential manager for:
receiving and associating the credentials mapped to the claim with applications from the secure store database; and
encrypting and decrypting the credentials stored in the secure store database and upon request by the SSS, sending the decrypted credentials to the SSS;
a key manager for:
encrypting the credentials for storing in the secure store database associated with the SSS using a master key;
encrypting the master key using an administrator provided pass phrase as a master secret key, wherein the master secret key is stored along with the encrypted credentials in a registry associated with the application server;
synchronizing the master key to a new service instance at the key manager;
modifying the master secret key at the key manager and storing the master secret key at the registry associated with the application server;
backing up and restoring the secure store database; and
the secure store database for storing the encrypted credentials and the master key, wherein the secure store database is hosted on a database server and managed by the application server.
15. The system of
support ticketing for requests where a submitter of the requests and an authorized user associated with the request are distinct.
16. The system of
an application manager for:
enabling a user to at least one from a set of: create, read, and delete an application.
17. The system of
18. The system of
|
Many enterprise applications use custom credentials such as a user name and password or leverage some other credentials mechanism for security purposes. When interoperation with external applications is needed, a user may be required to enter the credentials for the external application(s). This creates challenges for security (like users keeping their passwords in unsafe locations) and system management.
Users not having to remember multiple credentials—especially with hard to remember strong passwords—is preferred both by users and system administrators. One solution that has been tried is Single Sign On (SSO) approach, which attempts to mitigate the credential challenge by storing the credentials mapped to a particular user. However, these technologies have hard dependencies in the underlying authentication mechanism.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to exclusively identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.
Embodiments are directed to transforming claim based identities to a set of credentials, which may then be used to authenticate applications requiring specific credential types. According to some embodiments, the transformation may be performed by presenting the claim based identity via a token. According to other embodiments, a plurality of credentials may be generated based on a claim based identity and securely stored.
These and other features and advantages will be apparent from a reading of the following detailed description and a review of the associated drawings. It is to be understood that both the foregoing general description and the following detailed description are explanatory and do not restrict aspects as claimed.
As briefly described above, claim based identities may be transformed into credential based identities employing a token. In the following detailed description, references are made to the accompanying drawings that form a part hereof, and in which are shown by way of illustrations specific embodiments or examples. These aspects may be combined, other aspects may be utilized, and structural changes may be made without departing from the spirit or scope of the present disclosure. The following detailed description is therefore not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents.
While the embodiments will be described in the general context of program modules that execute in conjunction with an application program that runs on an operating system on a personal computer, those skilled in the art will recognize that aspects may also be implemented in combination with other program modules.
Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and comparable computing devices. Embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Embodiments may be implemented as a computer-implemented process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media. The computer program product may be a computer storage medium readable by a computer system and encoding a computer program that comprises instructions for causing a computer or computing system to perform example process(es). The computer-readable storage medium can for example be implemented via one or more of a volatile computer memory, a non-volatile memory, a hard drive, a flash drive, a floppy disk, or a compact disk, and comparable media. The computer program product may also be a propagated signal on a carrier (e.g. a frequency or phase modulated signal) or medium readable by a computing system and encoding a computer program of instructions for executing a computer process.
Throughout this specification, the term “platform” may be a combination of software and hardware components for flattening multi-dimensional data. Examples of platforms include, but are not limited to, a hosted service executed over a plurality of servers, an application executed on a single server, and comparable systems. The term “server” generally refers to a computing device executing one or more software programs typically in a networked environment. However, a server may also be implemented as a virtual server (software programs) executed on one or more computing devices viewed as a server on the network. More detail on these technologies and example operations is provided below.
Furthermore, administrators may enter credentials on behalf of users in a system according to embodiments. Thus, administrators do not have to reveal the credentials to end users, still enabling them to connect to an external application. Administrators may also bulk-load credentials, making it easier to manage systems with large number of subscribers.
In system 100, relying party 106 may authorize user/subject 104 by verifying claims provided by user/subject 104. Relying party 106 receives the claims from a trusted source such as identity provider 102 and uses them to authorize resources managed by the relying party. The interactions may include issuance of a claims token by identity provider 102 in response to a request by the subject/user 104, forwarding of the token to relying party 106 and authorization of resources by relying party 106. The token issuance by the identity provider 102 may be performed by a framework transparent to the user and the trust (103) between the relying party 106 and identity provider 102 may be established as specified by the claims specification. Data store 108 may be utilized to store information associated with the resources managed by relying party 106.
Credentials stored in secure store database 230 may be kept encrypted. Credential encryption/decryption may happen on the application server 220. A master key may be used to encrypt the stored credentials managed by key manager 222. Key management feature of SSS 228 may generate the master key after SSS provision, synchronize the master key to a new service instance, synchronize the master key to service instances when managed accounts change, modify a master secret key, back up or restore the secure store database, or provide the master key to a secure service object model for encryption/decryption.
As discussed previously, claim based identities are transformed to credential based identities according to one embodiment. Upon receiving an indication from a user for accessing a resource managed by SSS 228, client 214 may send a request security token (RTS) to a collaborative service 212 such as security token service (STS). STS 212 returns a token with a request security token response (RSTR). Both the client 214 and the STS 212 may be part of a web front end 210 in a web based hosted service.
A secure store service (SSS) proxy module 216 with client 214 may then provide the token, which may be a SAML token to SSS 228 along with a request for a resource. In addition to the key manager 222, SSS 228 may include application manager interface 226, which may declare an application management API for allowing users and administrators to create, read, and/or delete applications. Some of the application management methods may require administrative privilege. Thus, access verifications through the credentials may be performed before accessing each public method. A credential management API declared through credential manager interface 224 may be used to get and to set credentials for an application. Ticketing, which is used in cases where a component submitting the actual request does not have a direct access to the credentials of the user, may be supported and managed through credential manager interface 224.
Frameworks such as Windows Communication Foundation® (WCF) are designed in accordance with service oriented architecture principles to support distributed computing where services are consumed by consumers. Clients can consume multiple services and services can be consumed by multiple clients. Services typically have a standardized interface which any WCF client can use to consume the service, irrespective of which platform the service is hosted on. In diagram 300, WCF framework handles communication between components in web front end 340 and application server 350 processing token issuance in a transparent manner to the user. Service consumers such as web controls/parts 342, as well as external consumers such as rich client 334 or browser 332 (enabling a user to access service resources) communicate with the secure store service (356) through web front end 340 and not directly. Standard or custom APIs may be utilized to facilitate exchanges between web controls/parts 342 and SSS proxy 344 and/or SSS proxy 346.
SSS 356, SSS application 354, SS database 358, and SSS instance(s) 352 may reside on application server 350 accessible by web front end 340 in a shared service environment. As mentioned above communication between the components of the secure store system on application server 350 and consumers and other components on web front end 350 may be facilitated by the WCF framework.
Additionally, a database server 360 may be employed to manage a configuration database 362, a secure store database 366, and contents database(s) 364. Since the configuration database 362 may be less secure than SS database 358, master key for encrypting stored credentials may not be stored in configuration database 362. Each application server may also store the master key in its registry, which may be provided securely to a secure store administrator.
Interactions begin with client 470 sending a claims token request 480 to STS 474. In response, STS 474 may send the token (e.g. an SAML token) (481) to client 470. Next, client 470 requests credentials (482) through SSS proxy 472 from SSS 476. SSS 476 upon receiving the credential request 483 from SSS proxy 472 may validate claims 484 and request credentials (485) from SS credential manager 478. SS credential manager 478 retrieves credentials (486) from credentials database, where they may be stored encrypted.
To allow efficient management of the encrypted credentials using a master key while at the same time securing the key, the master key may be stored along the credentials, and for security, encrypted with trusted source provided passphrase. Encrypted master secret key may also be stored the registries of the application servers. The passphrase may be supplied by a secure store administrator after the provisioning of the service and not stored anywhere for security.
SS credential manager 478 may decrypt the credentials (487) and send the decrypted credentials (488) to SSS 476. The credentials are then provided (489 and 490) by SSS 476 to client 470 through SSS proxy 472. Client 470 may provide the credentials anytime a resource is need from the hosted service.
Secure store systems, components, and identity transformation mechanisms discussed in the figures above and below are for illustration purposes only and do not constitute a limitation on embodiments. Other embodiments using different system components, communication mechanisms, and configurations may be implemented without departing from a scope and spirit of the disclosure.
Client devices 511-513 may be used to provide access for users to a hosted service providing resources. Security for access to the resources of the hosted service may be achieved by transforming claim based identities used by a user into credentials and storing the credentials securely for use anytime the user requests access to a resource. Data associated with the credentials, encryption of the credentials, and other parameters of the system may be stored in one or more data stores (e.g. secure data store 516), which may be managed by any one of the servers 518 or by database server 514.
Network(s) 510 may comprise any topology of servers, clients, Internet service providers, and communication media. A system according to embodiments may have a static or dynamic topology. Network(s) 510 may include a secure network such as an enterprise network, an unsecure network such as a wireless open network, or the Internet. Network(s) 510 may also coordinate communication over other networks with additional servers, client devices, and other specialized computing devices. Network(s) 510 provides communication between the nodes described herein. By way of example, and not limitation, network(s) 510 may include wireless media such as acoustic, RF, infrared and other wireless media.
Many other configurations of computing devices, applications, data sources, and data distribution systems may be employed to implement a secure store service with identity transformation. Furthermore, the networked environments discussed in
Transformation of claim based identities to credentials may be performed by a distinct application within secure store service 622 or integral modules of the hosted service. Key manager 624 may manage encryption key for securely storing credentials in a secure data store. Credential manager 626 may get and set credentials for an application. Credential manager 626 may also support ticketing used in cases where a component that does the actual request for a resource does not have direct access to the credentials of the user who initiated the original request. This basic configuration is illustrated in
Computing device 600 may have additional features or functionality. For example, the computing device 600 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in
Computing device 600 may also contain communication connections 616 that allow the device to communicate with other devices 618, such as over a wireless network in a distributed computing environment, a satellite link, a cellular link, and comparable mechanisms. Other devices 618 may include computer device(s) that execute communication, data storage, and comparable applications associated with a hosted service providing resources. Communication connection(s) 616 is one example of communication media. Communication media can include therein computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.
Example embodiments also include methods. These methods can be implemented in any number of ways, including the structures described in this document. One such way is by machine operations, of devices of the type described in this document.
Another optional way is for one or more of the individual operations of the methods to be performed in conjunction with one or more human operators performing some. These human operators need not be collocated with each other, but each can be only with a machine that performs a portion of the program.
Process 700 begins with operation 710, where credentials are set based on input from a user or other source. At subsequent operation 720, a claim based identity is received at a trusted source such as a Secure Token Service (STS). At following operation 730, the claim based identity is authenticated and a token such as a SAML token sent to the secure store service (SSS), where the credential is mapped to a claim associated with the claim based identity as indicated on the token at operation 740. This is followed by operation 750, where the mapped credentials are stored securely (e.g. through encryption). At operation 760, a result is returned to the user confirming successful mapping and storage of the credentials.
Process 800 begins with operation 810, where credentials are obtained. At operation 820, a claim based identity is received at a trusted source such as a Secure Token Service (STS). At following operation 830, the claim based identity is authenticated and a token such as a SAML token sent to the secure store service (SSS), from where one or more credentials mapped to a claim associated with the claim based identity as indicated on the token are retrieved at operation 840. This is followed by operation 850, where the retrieved credentials are decrypted. At operation 860, the decrypted credentials are returned to the user for use in authorization of the user to an access controlled resource.
The operations included in processes 700 and 800 are for illustration purposes. Transforming claim based identities to credential based identities may be implemented by similar processes with fewer or additional steps, as well as in different order of operations using the principles described herein.
The above specification, examples and data provide a complete description of the manufacture and use of the composition of the embodiments. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims and embodiments.
Dalzell, Javier, Varkey, Saji, Raj, Kaushik
Patent | Priority | Assignee | Title |
10320771, | Nov 30 2016 | VMware LLC | Single sign-on framework for browser-based applications and native applications |
10623410, | Apr 24 2017 | Microsoft Technology Licensing, LLC | Multi-level, distributed access control between services and applications |
8756665, | Jul 08 2011 | International Business Machines Corporation | Authenticating a rich client from within an existing browser session |
8826436, | Dec 08 2010 | AT&T Intellectual Property I, L.P.; AT&T Intellectual Property I, L P | Systems, methods and apparatus to apply permissions to applications |
8955072, | Nov 05 2009 | VMware LLC | Single sign on for a remote user session |
9027093, | Dec 30 2009 | International Business Machines Corporation | Business process enablement for identity management |
9092609, | Jul 08 2011 | International Business Machines Corporation | Authenticating a rich client from within an existing browser session |
9413742, | Dec 08 2010 | AT&T Intellectual Property I, L.P. | Systems, methods and apparatus to apply permissions to applications |
9479492, | Mar 23 2012 | Amazon Technologies, Inc. | Authored injections of context that are resolved at authentication time |
9596246, | Oct 13 2010 | SALESFORCE, INC | Provisioning access to customer organization data in a multi-tenant system |
9628469, | Nov 05 2009 | VMware LLC | Single sign on for a remote user session |
9819668, | Oct 22 2014 | CA, Inc. | Single sign on for native and wrapped web resources on mobile devices |
9819672, | Jun 26 2015 | EMC IP HOLDING COMPANY LLC | Sharing access tokens with trusted users |
9910997, | Dec 23 2014 | GOOGLE LLC | Secure credential storage |
Patent | Priority | Assignee | Title |
20020184521, | |||
20030065940, | |||
20050097350, | |||
20060080352, | |||
20060123472, | |||
20060136990, | |||
20070186106, | |||
20070204168, | |||
20070204325, | |||
20070255841, | |||
20070255958, | |||
20080184339, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Dec 11 2008 | DALZELL, JAVIER | Microsoft Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 023109 | /0140 | |
Dec 11 2008 | VARKEY, SAJI | Microsoft Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 023109 | /0140 | |
Dec 11 2008 | RAJ, KAUSHIK | Microsoft Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 023109 | /0140 | |
Dec 16 2008 | Microsoft Corporation | (assignment on the face of the patent) | / | |||
Oct 14 2014 | Microsoft Corporation | Microsoft Technology Licensing, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 034564 | /0001 |
Date | Maintenance Fee Events |
Apr 06 2016 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Apr 14 2020 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Mar 21 2024 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
Date | Maintenance Schedule |
Oct 23 2015 | 4 years fee payment window open |
Apr 23 2016 | 6 months grace period start (w surcharge) |
Oct 23 2016 | patent expiry (for year 4) |
Oct 23 2018 | 2 years to revive unintentionally abandoned end. (for year 4) |
Oct 23 2019 | 8 years fee payment window open |
Apr 23 2020 | 6 months grace period start (w surcharge) |
Oct 23 2020 | patent expiry (for year 8) |
Oct 23 2022 | 2 years to revive unintentionally abandoned end. (for year 8) |
Oct 23 2023 | 12 years fee payment window open |
Apr 23 2024 | 6 months grace period start (w surcharge) |
Oct 23 2024 | patent expiry (for year 12) |
Oct 23 2026 | 2 years to revive unintentionally abandoned end. (for year 12) |